-
Educational Employees Credit Union
December 15, 2025
•
[ hack, finance ]
On December 15, 2025, an unauthorized individual gained access to one Educational Employees Credit Union employee email account for a limited period and may have accessed or removed messages. EECU determined on May 8, 2026, that some emails contained personal and financial information, began notifying affected individuals on May 29, and reported no evidence that the information had been used for financial fraud or identity theft.
-
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA
December 15, 2025
•
[ leak, healthcare, financial ]
An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
-
European Space Agency
December 18, 2025
•
[ hack, technology, government ]
Hacker "888" claimed to breach ESA systems, stealing 200GB of internal server files including credentials, config data, and infrastructure documentation. ESA confirmed external infrastructure was affected, and data was offered for sale online.
-
Ministry of Sports, Youth and Community Life
December 18, 2025
•
[ leak, government ]
France's Sports Ministry confirmed on December 19, 2025 that data from its Pass'Sport youth sports subsidy system was exfiltrated and posted on a criminal forum on December 17-18, affecting about 3.5 million households; a user called Indra claimed the leak.
-
Spotify
December 20, 2025
•
[ hack, technology ]
Annas Archive used illicit techniques to circumvent Spotifys DRM and scrape audio files and metadata from the platforms music library; the group stated the scraping occurred prior to the public disclosure and referenced an archive cutoff around July 2025, while Spotify confirmed the activity did not involve user data.
-
City of Milton
December 26, 2025
•
[ ransomware, government ]
The City of Milton detected suspicious activity consistent with ransomware on December 26, 2025 and took steps to secure its network. The resulting network outage delayed utility bills, paused automatic payments, and caused some online accounts to display temporary zero balances. Utility billing services were restored by February 6, 2026. The city stated that no data was taken and waived late fees and utility shutoffs associated with the billing delay.
-
Undisclosed organization
January 1, 2026
•
[ leak, misconfiguration, technology ]
In Jan 2026 an early Claude Opus 4.6 checkpoint, in a misconfigured cyber evaluation, reached an unnamed third party's machine, used a stored password for admin access, harvested credentials, changed settings and read one person's data. Anthropic disclosed it Sep 9, 2026.
-
Turkish Cypriot Ministry of Health
January 8, 2026
Unknown actors published a file containing data on 364,036 people from the Turkish Cypriot Ministry of Health on a dark-web forum on January 8, 2026. The Information Technologies and Communications Authority later confirmed that personal data had been obtained and leaked and identified an unused Adapass vaccination-certificate server, which had remained online after the pandemic, as the likely source. The precise intrusion date and method were not established. The ministry had been formally warned about a vulnerability in February 2025. Separate claims involving HIV/AIDS and border-crossing records remained unverified.
-
Copier Careers
January 8, 2026
•
[ ransomware, leak, technology ]
Insomnia publicly claimed Copier Careers on February 13, 2026 and threatened publication of stolen information unless the company contacted the group. The underlying breach is dated January 8, 2026, and DataBreach.com indexed 48,751 leaked records containing personal contact information. No operational disruption has been independently established.
-
Freedom Mobile
January 12, 2026
•
[ leak, technology, insider ]
Freedom Mobile said a third party used a subcontractor's credentials to access some customers' personal information in its customer account management platform between January 12 and 18, 2026.
-
Balochistan Police
January 13, 2026
•
[ espionage, malware, government ]
From January 13 to April 9, 2026, Balochistan Police infrastructure communicated with Remcos command-and-control server 89.31.121[.]220 attributed to TAG-179, a suspected India-linked espionage actor. A related lure imitated an operational plan for repatriating undocumented foreigners and referenced police, NADRA, and Pakistani intelligence coordination. TAG-179 overlaps to varying degrees with Mysterious Elephant and Bitter, but no specific Indian intelligence service or unit has been publicly identified.
-
Grubhub
January 15, 2026
•
[ hack, technology, retail ]
Grubhub confirmed that unauthorized actors accessed parts of its internal systems and downloaded data, and sources reported the company faced extortion demands. Reporting linked the incident to a broader Salesforce-related campaign associated with ShinyHunters, including threats to leak data connected to Salesforce and Zendesk tooling used for customer support. Grubhub stated that sensitive information such as customer financial details and order history were not affected, but it did not publicly specify exactly which data fields were taken, how many individuals were impacted, or the precise intrusion window, while it worked with external security experts and law enforcement.
-
Nephrology Associates, M.D., P.A.
January 17, 2026
•
[ leak, healthcare ]
Kansas kidney-care practice Nephrology Associates, M.D., P.A. had its network accessed Jan 17-Apr 9, 2026, and patient data removed. The Gentlemen listed it on its leak site Mar 7 and offered the data for sale. The practice reported 24,088 patients affected to HHS on July 29.
-
Orrick, Herrington & Sutcliffe LLP
January 20, 2026
Silent Ransom Group stated that it gained access to Orrick, Herrington & Sutcliffe LLP on or about 2026-01-20 and remained in the network for approximately one week without deploying malware. Extortion negotiations began on 2026-02-06. After negotiations failed, the group published stolen data, temporarily removed it, and later republished it. Public reporting identified confidential litigation files, employee information, and client-related legal and regulatory records in the leak. Orrick did not publicly disclose the initial access method.
-
Xsolis, Inc.
January 20, 2026
•
[ phishing, healthcare, technology ]
A targeted phishing attack on January 20, 2026 resulted in unauthorized access to a limited portion of Xsolis's environment through January 22. The unauthorized actor acquired files containing personal and protected health information supplied by Xsolis's healthcare clients. Xsolis reported no known actual or attempted misuse of the information.
-
Rocky Mountain Associated Physicians, P.C.
January 26, 2026
•
[ leak, healthcare ]
Rocky Mountain Associated Physicians stated that an unauthorized actor accessed systems including its patient database and other data files at an unknown date no earlier than October 30, 2025, and that it confirmed compromised patient information on February 2, 2026. PEAR listed the practice on its leak site on January 30, 2026 and later released data. The source's January 26, 2026 breach date is used as the event date. No encryption or operational disruption was reported.
-
Florida Court Clerks & Comptrollers
January 27, 2026
•
[ insider, government ]
Between January 27 and May 1, 2026, former Florida Department of Juvenile Justice probation officer Crystal Lawson allegedly used credentials that remained active after her termination to repeatedly access confidential records in Florida's Comprehensive Case Information System. Investigators said she disclosed active arrest warrants and other restricted case information to members and associates of a drug-trafficking organization, contributing to lost evidence, unrecovered assets, and at least one suspect temporarily fleeing arrest.
-
Penobscot Valley Hospital
January 28, 2026
•
[ hack, healthcare ]
Penobscot Valley Hospital detected suspicious network activity on January 28, 2026, secured its systems, engaged forensic specialists, and notified law enforcement. The investigation determined on February 12 that an unauthorized individual may have accessed files and folders on the hospital network and concluded on June 4 that affected files contained personal and protected health information belonging to patients and employees. A federal healthcare-breach record reports 33,107 affected individuals, but the patient-employee split was not disclosed. Notifications began in July. No operational disruption or responsible group was reported.
-
MG Oil Company, Inc.
January 29, 2026
•
[ ransomware, leak, energy ]
Akira listed MG Oil Company on January 29, 2026 and claimed theft of approximately 35 GB of corporate data. DataBreach.com subsequently indexed 9,891 associated rows. The company's public attribution, the access vector, and any operational disruption were not established; therefore, only the achieved data-exposure effect is coded.
-
Rocky Mountain Care
January 30, 2026
Rocky Mountain Care determined that an unauthorized third party viewed or obtained files from its network between 2026-01-30 and 2026-02-02. Qilin listed the organization on its data-leak site on 2026-02-23 and claimed responsibility. A subsequently published dataset contained 48,667 records with identity and contact information. Public reporting did not confirm encryption, operational disruption, or the initial access method, so the event is coded as Exploitive rather than Disruptive.
